Linux kernel vulnerabilities

In the Linux kernel, the net/sched act_gate (gate action) has a race condition where the schedule list can be accessed concurrently during replacement, hrtimer callback, or dump. This can lead to use-after-free or data corruption.

In the Linux kernel, a vulnerability in the RDMA/umad driver was found where ib_umad_write computed data_len from user-controlled values, potentially resulting in a negative value. A negative data_len caused incorrect padding calculations in alloc_send_rmpp_list, leading to an out-of-bounds write (slab-out-of-bounds).

In the Linux kernel, a potential NULL pointer dereference was found in the RDMA/siw driver during header processing. If siw_get_hdr() returns -EINVAL before set_rx_fpdu_context(), qp->rx_fpdu can be NULL, and the error path in siw_tcp_rx_data() dereferences it without checking.

An infinite loop bug was found in the Linux kernel's NTFS3 file system. An attacker can trigger a Denial-of-Service by mounting a malformed NTFS image with a zero-sized ATTR_LIST attribute, causing the mount process to hang indefinitely.

In the Linux kernel, a bug in the ntfs3 filesystem causes an infinite loop during lookup operations. A malformed directory entry can hang the kernel and exhaust memory (OOM).

In the Linux kernel's NTFS3 filesystem, an infinite loop bug was found. Inconsistent NTFS metadata, where an attribute reports an empty run list (evcn=-1) but the directory expects data, causes attr_load_runs_range() to loop indefinitely, exhausting system resources.

In the Linux kernel netfilter nf_tables subsystem, a use-after-free vulnerability was found in nf_tables_addchain(). The chain is published to the list before hook registration, and on registration failure it is removed and destroyed without waiting for ongoing RCU operations, leading to two use-after-free scenarios: in the control path (chain dump) and in the packet path (transient IPv4 hook).

In the Linux kernel qla2xxx driver, a NULL pointer dereference vulnerability was found during memory deallocation. The issue occurs in qla_fab_async_scan when the sp (srb_t) pointer is NULL, causing a system crash (kernel panic).

In the Linux kernel, the cls_u32 network classifier module lacks proper validation of negative offset values in the skb_header_pointer() function. This can lead to a slab-out-of-bounds read in u32_classify() when processing crafted network packets.

In the Linux kernel, the iwlwifi driver (MLD subsystem) fails to cancel the mlo_scan_start_wk work item on disconnection. This can cause an init-after-queue issue or a use-after-free if the work executes after the virtual interface (vif) is freed.

A race condition in the Linux kernel's MMP PDMA DMA driver leads to a use-after-free vulnerability. The mmp_pdma_residue() function lacks proper locking, allowing access to freed descriptor memory during list iteration.

In the Linux kernel, a reference count leak was found in the SMB server's parse_durable_handle_context() function. When the command is a replay operation and -ENOEXEC is returned, the reference count of the ksmbd_file object is not released.

A bug in GSO segmentation for GRO packets with frag_list was fixed in the Linux kernel, causing low throughput during IPv4/IPv6 protocol translation by XLAT. The issue occurred because skb_segment_list incorrectly processed GRO packets after translation, as XLAT only translates the header of the head skb, leaving frag_list skbs untranslated. The patch forces the SKB_GSO_DODGY flag for GSO packets in translation helpers, ensuring fallback to the safer skb_segment function instead of skb_segment_list.

A new IOMMU interface was added to the Linux kernel to flush IOTLB entries for the CPU kernel address space. This fixes the main issue with vfree(), which can be triggered by unprivileged users, but does not cover extremely rare cases of memory unplug of reserved memory.

In the Linux kernel, a vulnerability in the netfs mechanism causes premature unlocking of a folio when the end-of-file (EOF) is reached, potentially allowing an application to read uninitialized data via mmap. The issue occurs when read result collection outpaces subrequest completion, and the zeroing subrequest (ZERO) runs after the folio is unlocked.

In the Linux kernel's io_uring/io-wq subsystem, a vulnerability can cause prolonged blocking of io-wq worker threads during exit. Processing large read operations (e.g., 2GB - 4096b) from /dev/msr* files, which lack ->read_iter() support, each read may take up to 20 seconds, leading to hung task timeouts (140 seconds) and error reports.

A vulnerability in the Linux kernel's netfilter nf_tables module involves an inverted genmask check in nft_map_catchall_activate(). During transaction abort, catchall map elements are not properly reactivated, causing a chain->use reference count leak and leading to a use-after-free condition.

A race condition in the Linux kernel's SCSI layer can prevent the error handler from waking up when final commands complete concurrently. The issue stems from memory ordering problems and incorrect sequencing between counting busy commands and incrementing the failed counter. This can cause I/O on the SCSI host to become stuck in an error state.

In the Linux kernel ipvlan driver, a locking issue was found where addrs_lock was per-device instead of per-port. The fix moves the lock to port level, preventing potential races when adding/removing IPv6 addresses without RTNL.

A bug was found in the Linux kernel's hugetlb_pmd_shared() function, which incorrectly detects PMD table sharing for hugetlb pages. Instead of using the dedicated share count (pt_share_count), the function still relied on the refcount, causing shared PMD tables not to be recognized as shared. This leads to incorrect page migration (e.g., mbind) and wrong reporting in smaps and pagemap interfaces.

A vulnerability has been identified in the Linux kernel regarding the limitation of BOND_MODE_8023AD to Ethernet devices. This issue has been resolved, but it could have previously led to memory access errors.

A memory leak in the Linux kernel's GUE (Generic UDP Encapsulation) implementation was discovered due to incorrect handling of packets with inner IP protocol 0. The gue_udp_recv() function returns -proto_ctype for resubmission, which fails for protocol 0, causing skb memory leak.

In the Linux kernel, a vulnerability in the Xen scsiback driver was found where memory allocated for the vscsiblk_info structure in scsiback_probe() is not freed in scsiback_remove() or in error paths of scsiback_probe(), leading to potential memory leaks.

In the Linux kernel, a vulnerability in the vsock/virtio driver allowed TX credit to be derived solely from the remote endpoint's peer_buf_alloc. A malicious guest or host could advertise a large buffer and read slowly, forcing the other side to allocate excessive sk_buff memory, leading to out-of-memory (OOM) conditions.

In the Linux kernel, a vulnerability was found in the be2net driver, involving a NULL pointer dereference in the be_cmd_get_mac_from_list function. The issue occurs when the function is called with pmac_id_valid set to false and pmac_id pointer set to NULL, leading to a write attempt at address NULL.

In the Linux kernel, a vulnerability was found in the FOU (Foo-over-UDP) module. When the FOU_ATTR_IPPROTO attribute is set to 0, the fou_udp_recv() function neither frees the skb buffer nor resubmits it, leading to a memory leak.

In the Linux kernel, a vulnerability in the teql (TrueLink Equalizer) queuing discipline lacks enforcement that teql can only be used as a root qdisc. This allows an attacker to configure it as a child qdisc, leading to data inconsistency and a potential Use-After-Free (UAF).

A vulnerability in the Linux kernel's authencesn crypto module allows a kernel panic (DoS) via a too-short AAD (assoclen<8). Missing validation of the authentication data length leads to an out-of-bounds read on the destination scatterlist and a NULL pointer dereference.

In the Linux kernel, the hv_netvsc driver lacks a check for the RX indirection table when programming the RSS hash key. When the device reports a single receive queue, the table is not allocated, and attempting to update the RSS key causes a system hang.

In the Linux kernel, a vulnerability in the ftrace mechanism causes overallocation of memory due to incorrect calculation of entries per page (ENTRIES_PER_PAGE). The issue occurs when PAGE_SIZE is not a multiple of ENTRY_SIZE, leading to kernel warnings and potential resource waste.

A vulnerability was found in the Linux kernel's w1 thermometer driver (w1: therm) due to an off-by-one buffer overflow in the alarms_store function. The sysfs buffer is allocated with 'size + 1' bytes, but the function allocates only 'size' bytes and then uses strcpy(), causing a write one byte past the allocated buffer. The fix parses the 'buf' parameter directly using simple_strtoll() without memory allocation.

In the Linux kernel, a double free vulnerability was found in the ALSA AC97 module in the snd_ac97_controller_register() function. If ac97_add_adapter() fails, using kfree() instead of put_device() leads to a double free.

A memory leak was found in the Linux kernel in the nfs4_ff_alloc_deviceid_node() function within the pnfs/flexfiles driver. When allocation for ds_versions fails, the function jumps to the out_scratch label without freeing the already allocated dsaddrs list, causing a memory leak.

In the Linux kernel, a memory leak was found in the gpi_peripheral_config() function of the QCOM GPI DMA driver. The issue occurs when krealloc() returns NULL, causing loss of reference to previously allocated memory.

In the Linux kernel, a NULL pointer dereference vulnerability was found in the Marvell Prestera network driver. The devlink_alloc() function may return NULL on allocation failure, but the code unconditionally calls devlink_priv() on the returned pointer, causing a system crash.

In the Linux kernel, the at_hdmac driver has a device reference leak in of_dma_xlate(). The reference taken when looking up the DMA platform device is not dropped after successful channel allocation, causing a memory leak.

A vulnerability in the Linux kernel's BCM-SBA-RAID DMA driver causes a device reference leak during probe. The driver fails to drop the reference taken when looking up the mailbox device on probe failures or driver unbind.

In the Linux kernel, a vulnerability in the dw_dmamux DMA driver causes an OF node reference leak on late DMA route allocation failure. The reference taken to the DMA master OF node is not released when route allocation fails after the initial setup.

In the Linux kernel, a device reference leak was found in the STM32 DMA MUX driver during route allocation. The allocation function failed to drop the reference taken when looking up the DMA mux platform device.

In the Linux kernel, a device reference leak was found in the DMA crossbar driver for TI AM335x. The reference to the crossbar platform device was not dropped during route allocation, causing a memory leak.

A vulnerability in the Linux kernel's IP over GRE (ip_gre) driver allows a system crash via kernel panic due to insufficient buffer space checks before adding the GRE header. This can be triggered by specially crafted network traffic, leading to a skb_under_panic error.

A use-after-free vulnerability was found in the Linux kernel's inet6_addr_del() function for IPv6. The bug was introduced by accidentally moving ipv6_del_addr() before reading ifp->flags for temporary addresses, leading to use of freed memory.

A vulnerability in the Linux kernel's XSAVE/XRSTOR mechanism for KVM virtual machines was found. When XSTATE_BV indicates an enabled feature that is disabled by XFD, attempting to restore that state via XRSTOR causes a #NM fault and kernel panic. This occurs when loading guest state via KVM_SET_XSAVE or updating XFD in response to guest WRMSR.

In the Linux kernel, the __ip6_tnl_rcv() function for IPv6 tunnels lacked proper handling of VLAN-encapsulated frames, leading to use of uninitialized memory. The issue was reported by syzbot and manifested as a KMSAN bug in the ECN decapsulation logic.

A vulnerability in the Linux kernel has been fixed in the qfq_change_class() function, which could lead to use-after-free (UAF) errors. The issue was related to improper freeing of an existing class in the event of an error.

A vulnerability has been identified in the Linux kernel that leads to NULL pointer dereferences in the nvmet_tcp_build_pdu_iovec function. This issue occurs when command data structures are not properly initialized before processing H2C_DATA PDUs.

A vulnerability has been identified and resolved in the Linux kernel. The issue pertains to the j1939_xtp_rx_rts_session_active() function, which does not deactivate the session upon receiving the second RTS, leading to a reference count leak for j1939_session.

In the Linux kernel, a vulnerability in the idxd DMA driver causes device reference leaks during compat bind and unbind operations. Failure to release references leads to improper memory management.

A use-after-free vulnerability was found in the Tegra ADMA driver in the Linux kernel. The issue occurs when audio streams are terminated, as the DMA buffer is freed before the completion tasklet finishes, leading to access to freed memory.

A reference count leak was discovered in the Linux kernel's bpf_prog_test_run_xdp() function. The issue occurs when the error handling path fails to call xdp_convert_buff_to_md(), causing a network interface (e.g., sit0) to remain stuck and preventing its release.